linux/drivers/media/radio/wl128x
Dan Carpenter 9c2ccc324b media: wl128x: prevent two potential buffer overflows
Smatch marks skb->data as untrusted so it warns that "evt_hdr->dlen"
can copy up to 255 bytes and we only have room for two bytes.  Even
if this comes from the firmware and we trust it, the new policy
generally is just to fix it as kernel hardenning.

I can't test this code so I tried to be very conservative.  I considered
not allowing "evt_hdr->dlen == 1" because it doesn't initialize the
whole variable but in the end I decided to allow it and manually
initialized "asic_id" and "asic_ver" to zero.

Fixes: e8454ff7b9 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
2019-03-29 07:43:48 -04:00
..
fmdrv_common.c media: wl128x: prevent two potential buffer overflows 2019-03-29 07:43:48 -04:00
fmdrv_common.h media: fix usage of whitespaces and on indentation 2018-01-04 13:12:01 -05:00
fmdrv_rx.c [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
fmdrv_rx.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
fmdrv_tx.c [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
fmdrv_tx.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
fmdrv_v4l2.c media: replace strcpy() by strscpy() 2018-09-11 13:32:17 -04:00
fmdrv_v4l2.h [media] media: Drop FSF's postal address from the source code files 2017-01-27 11:38:09 -02:00
fmdrv.h media: radio: fix several typos 2019-03-01 09:26:50 -05:00
Kconfig media: v4l: fix broken video4linux docs locations 2018-06-15 18:10:01 -03:00
Makefile [media] drivers:media:radio: wl128x: Kconfig & Makefile for wl128x driver 2011-03-21 20:32:36 -03:00